CVE-2022-36749: 🐛 | Command Injection and XSS vulnerabilities reports · Issue #1859 · MiczFlor/RPi-Jukebox-RFID

I would like to report for possible vulnerability.

//line 136 if(isset($_GET[‘folder’]) && $_GET[‘folder’] != “”) { $post[‘folder’] = $_GET[‘folder’]; } else { if(isset($_POST[‘folder’]) && $_POST[‘folder’] != “”) { $post[‘folder’] = $_POST[‘folder’]; } } if(isset($_GET[‘filename’]) && $_GET[‘filename’] != “”) { $post[‘filename’] = $_GET[‘filename’]; } else { if(isset($_POST[‘filename’]) && $_POST[‘filename’] != “”) { $post[‘filename’] = $_POST[‘filename’]; } } //line 249 $fileName = Files::buildPath($post[‘folder’], $post[‘filename’]); $exec = “mid3v2 -l '” .$fileName ."’" ;

public static function buildPath(…$pieces) { return implode(DIRECTORY_SEPARATOR, $pieces); }

So the attacker can control the command injection through the filename.
The attacker can add ‘;’ and add another command like (echo <script>alert(document.cookie)<\script>.
The output pf the command will be printed through this path.

//line 252 // note: the output of the command is in $res $lines = explode(PHP_EOL, $res); foreach($lines as $line) { $parts = explode("=",$line); $key = trim(array_shift($parts)); // take the first $val = trim(implode("=",$parts)); // put the rest back together if (in_array($key, $trackDat[‘metaKeys’][‘mp3’])) { $trackDat[‘existingTags’][$key] = $val; } } //line 496 if (isset($trackDat[‘existingTags’][‘TCOM’]) && trim($trackDat[‘existingTags’][‘TCOM’]) != “”) { echo trim($trackDat[‘existingTags’][‘TCOM’]); }

Finally, I recommend using escapeshellarg function with the $_GET[‘folder’], $_POST[‘folder’], $_GET[‘filename’] and $_POST[‘filename’]